Changeset 6a99668 in Klonkt

Timestamp:

07/30/2026 12:38:57 PM (6 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

55eca8b

Parents:

f9b1c5c

Message:

Reply op een ander gefixt: gesigneerd resolven, eigen replies terug in de feed, duplicaat idempotent

Robins waarneming (30-7) legde de keten bloot: reply op jezelf lukt,
reply op een ander geeft 502. Drie oorzaken, drie fixes.

Een: resolveRemoteNote haalde de parent-note ANONIEM op. Een publieke
note (je eigen post) geeft dat, maar een friends-only note (de
Shaer-standaard!) weigert een anonieme GET terecht. Het reply-, like-
en boost-pad over C2S resolven nu gesigneerd als de eigen actor
(asSlug), zodat de andere server ziet wie er vraagt en serveert wat de
vriendschap verdient. Zelfde principe als friends-get-the-history, nu
ook aan de vraagkant.

Twee: je eigen verzonden replies (ap_outbox) werden nergens over C2S
geserveerd. Je reply bestond overal behalve in je eigen app: dus je
probeerde het opnieuw. De C2S inbox-read krijgt een derde leg:
getSentNotes bouwt ze via buildReplyNote (inReplyTo, Mention-tags,
attachments, friends-adressering), met de eigen shaer:author erop en de
leidende mention gestript zoals de DM-leg dat doet.

Drie: die herhaalpoging liep in de duplicate-guard, die zonder id
antwoordde; de ingest maakte daar 502 reply_failed van. Een duplicaat
is nu idempotent succes met het BESTAANDE id.

Changed files:
src/services/ActivityPubService.js

• resolveRemoteNote(url, {asSlug}): gesigneerde fetches (note, actor en de ancestor-keten); reply/like/boost/undo geven site.slug mee
• getSentNotes(base, site): eigen ap_outbox-rijen als AS2 Notes
• duplicate-guard geeft het bestaande id terug

src/routes/activitypub.js

• C2S inbox-read: sent-leg naast timeline en messages, zelfde vorm

New file:
test/sent-notes.test.js

• sent reply komt terug als threadbare Note (parent in to, Mention, media absoluut, ISO-published); duplicaat = zelfde id

-robo
Co-Authored-By: Claude Opus 4.8 <noreply@…>

Files:

• src/routes/activitypub.js (modified) (1 diff)
• src/services/ActivityPubService.js (modified) (8 diffs)
• test/sent-notes.test.js (added)

src/routes/activitypub.js

@@ -280 +280 @@
     },
   }));
-  // Newest first over both, so the app can keep treating this as one feed.
-  const items = [...posts, ...messages].sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
+  // Your OWN sent notes (replies and direct messages, ap_outbox): without
+  // them a reply existed everywhere except in your own app, Messages showed
+  // half a conversation, and a retry ran into the duplicate guard (Robins
+  // melding, 30-7). Served like the other legs: same shape, one parser.
+  const mine = AP.selfAuthor(base, auth.site);
+  const sent = AP.getSentNotes(base, auth.site, 60).map((n) => ({
+    id: `${n.id}#create`,
+    type: 'Create',
+    actor: me,
+    published: n.published,
+    // The leading mention anchor is addressing, not prose (the DM leg strips
+    // it the same way); the Mention tags built from the full content stay.
+    object: { ...n, content: AP.stripLeadingMentions(n.content), 'shaer:author': mine },
+  }));
+  // Newest first over all legs, so the app can keep treating this as one feed.
+  const items = [...posts, ...messages, ...sent].sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
   AP.sendAP(res, {
     '@context': AP.AP_CONTEXT,

src/services/ActivityPubService.js

@@ -2238 +2238 @@
 }
 
+// The account's own outbound notes (replies and direct messages) as AS2
+// Notes, newest first. The C2S inbox read serves these alongside the
+// timeline: without them your own reply existed everywhere EXCEPT in your
+// own app (Robins melding, 30-7: "replyen werkt nog niet"; het antwoord
+// stond op de server maar de app kreeg het nooit terug, dus je probeerde
+// het opnieuw en liep in de duplicate-guard).
+export function getSentNotes(base, site, limit = 60) {
+  return db.prepare('SELECT * FROM ap_outbox WHERE site_slug = ? ORDER BY created_at DESC LIMIT ?')
+    .all(site.slug, limit)
+    .map((row) => buildReplyNote(base, site, row));
+}
+
 // Resolve one of our outbound reply Notes by id (for /ap/notes/:id fallback).
 export function getOutboxNote(base, id) {
@@ -2319 +2331 @@
         }
         if (object.inReplyTo) {
-          const parent = await resolveRemoteNote(c2sIdOf(object.inReplyTo)).catch(() => null);
+          const parent = await resolveRemoteNote(c2sIdOf(object.inReplyTo), { asSlug: site.slug }).catch(() => null);
           if (!parent) return { status: 502, error: 'cannot_resolve_inReplyTo' };
           // The attachments ride along (Robins melding, 30-7: "502
@@ -2359 +2371 @@
           }
         }
-        const note = await resolveRemoteNote(targetUri).catch(() => null);
+        const note = await resolveRemoteNote(targetUri, { asSlug: site.slug }).catch(() => null);
         const objUri = (note && note.object_uri) || targetUri;
         const authorUri = note && note.actor_uri;
@@ -2397 +2409 @@
         if (innerType === 'Like' || innerType === 'Announce') {
           const kind = innerType === 'Announce' ? 'unboost' : 'unlike';
-          const note = await resolveRemoteNote(innerTarget).catch(() => null);
+          const note = await resolveRemoteNote(innerTarget, { asSlug: site.slug }).catch(() => null);
           const objUri = (note && note.object_uri) || innerTarget;
           await sendInteraction(site, kind, objUri, note && note.actor_uri);
@@ -2586 +2598 @@
   // Attachments count toward "the same": two media-only replies share content.
   const mediaJson = media.length ? JSON.stringify(media) : null;
-  const dup = db.prepare('SELECT 1 FROM ap_outbox WHERE site_slug = ? AND IFNULL(in_reply_to, \'\') = ? AND content = ? AND IFNULL(attachments, \'\') = IFNULL(?, \'\') LIMIT 1')
+  // A duplicate is idempotent success, not an error: it answers with the
+  // EXISTING id. Returning without one made the C2S ingest say 502
+  // reply_failed on a double-submit (Robins schermafdruk, 30-7), so a retry
+  // of a reply the app never showed looked like the reply itself failing.
+  const dup = db.prepare('SELECT id FROM ap_outbox WHERE site_slug = ? AND IFNULL(in_reply_to, \'\') = ? AND content = ? AND IFNULL(attachments, \'\') = IFNULL(?, \'\') LIMIT 1')
     .get(site.slug, parent.object_uri || '', content, mediaJson);
-  if (dup) { console.log('[AP] outreply skipped (duplicate)'); return { duplicate: true, delivered: 0 }; }
+  if (dup) { console.log('[AP] outreply skipped (duplicate)'); return { duplicate: true, id: dup.id, delivered: 0 }; }
   const id = crypto.randomUUID();
   iStmts().insO.run(id, site.slug, postId, postSlug || null, parent.object_uri || null, toActorUri, toHandle, content, replyLang, mediaJson);
@@ -2643 +2659 @@
 // Resolve a remote post URL (any fediverse/Klonkt post) into a reply target.
 // Returns a parent-shaped object usable by deliverReply(), or null.
-export async function resolveRemoteNote(url) {
+export async function resolveRemoteNote(url, opts = {}) {
   if (!/^https?:\/\//i.test(String(url || ''))) return null;
-  const note = await fetchActor(url).catch(() => null); // AP GET (content-negotiates)
+  // With `asSlug` the fetches are SIGNED as that local actor. An anonymous
+  // GET can only read public notes; a friends-only note (Shaer's default!)
+  // rightly refuses it, which made every reply to a friend's post fail while
+  // a reply to your own public post worked (Robins melding, 30-7). Signed,
+  // the other server sees WHO asks and serves what the friendship earns.
+  const get = (u) => (opts.asSlug ? signedGetJson(opts.asSlug, u) : fetchActor(u).catch(() => null));
+  const note = await get(url); // AP GET (content-negotiates)
   if (!note || !note.id) return null;
   const att = note.attributedTo;
   const actorUri = actorUriOf(att);
   if (!actorUri) return null;
-  const actor = await fetchActor(actorUri).catch(() => null);
+  const actor = await get(actorUri);
   const ai = actorInfo(actor, actorUri);
   // Is what we're replying to a post (or a comment) on one of OUR posts? If so,
@@ -2664 +2686 @@
     const url = typeof cursor === 'string' ? cursor : (cursor && cursor.id);
     if (!url) break;
-    const pn = await fetchActor(url).catch(() => null);
+    const pn = await get(url);
     if (!pn) break;
     const pa = actorUriOf(pn.attributedTo);
     if (pa && pa !== actorUri) {
-      const paDoc = await fetchActor(pa).catch(() => null);
+      const paDoc = await get(pa);
       const inbox = paDoc && ((paDoc.endpoints && paDoc.endpoints.sharedInbox) || paDoc.inbox);
       if (inbox && !seenInbox.has(inbox)) { seenInbox.add(inbox); threadInboxes.push(inbox); }
@@ -4167 +4189 @@
   buildActor, buildNote, buildCreate, buildOutbox, buildFollowers, buildFollowing, buildFeatured,
   followerCount, deliver, fetchActor, verifyRequest, handleInbox, deliverCreate, deliverDelete, deliverUpdate, deliverActorUpdate, resyncFeaturedPins,
-  getInteractions, getInteractionById, setInteractionBoosted, setInteractionLiked, setMyReaction, getMyReactions, buildReplyNote, getOutboxNote, deliverReply, resolveRemoteNote,
+  getInteractions, getInteractionById, setInteractionBoosted, setInteractionLiked, setMyReaction, getMyReactions, buildReplyNote, getOutboxNote, getSentNotes, deliverReply, resolveRemoteNote,
   listOutbox, deliverOutboxDelete, deliverOutboxUpdate, deliverDirectNote,
   webfingerResolve, followActor, resolveRemoteActor, unfollowActor, listFollowing, setAutoBoost, backfillFromOutbox, getTimeline, getDirectMessages, isoStamp, timelineAttachments, timelineEmojis, timelineObjectLinks, timelineQuote, timelineEmbed, applyQuoteProps, deliverToActor, sendInteraction, voteOnPoll, voteOnRemotePoll,